Requirement

Anyone storing covered data on portable devices (such as laptops and smartphones) or removable and easily transported storage media (such as USB drives or CDs/DVDs) must use industry-accepted encryption technologies.

Description of Risk

Malicious users may gain unauthorized physical or logical access to a device, transfer information from the device to an attacker’s system, and perform other actions that jeopardize the confidentiality of the information on a device.

Recommendations

Removable media and mobile devices must be properly encrypted following the guidelines below when used to store covered data. Mobile devices include laptops and smartphones.

Compliant Encryption Tools

Self Encrypting USB Drives are portable USB drives that embed encryption algorithms within the hard drive, thus eliminating the need to install any encryption software. The limitation of such devices is that the files are only encrypted when residing on the encrypted USB drive, which means files copied from the USB drive to be sent over email or other file sharing options will not protected. These USB drives are also typically more expensive than non-encrypting USB drives.

Full Disk Encryption Software is software that is used to encrypt otherwise unprotected storage media such as CDs, DVDs, USB drives or laptop hard drives. The flexibility of this software allows protection to be applied to a greater selection of storage media. However, the same limitation on collaboration applies to media encryption software as it does to Self Encrypting USB Drives.

Files must be worked on collaboratively by users in geographically distributed locations

Moderate or large data size

*Recent news on the TrueCrypt project raised questions about the long term viability of the software, older versions of TrueCrypt have not been found defective. We will update this page and the campus IT community if serious concerns about TrueCrypt are revealed.

The tools listed generally support modern operating systems such as Microsoft Windows, Mac OS X and Linux. Please consult vendor websites for specific system requirements.

Non-Compliant Encryption Tools

Many software applications provide password protections features that only provide a veil of security which is trivial to defeat. Software which does not meet encryption standards includes:

Adobe Acrobat prior to version 10.0 (a.k.a. version X)

Microsoft Office application prior to 2010

Winzip prior to version 9

In addition to following the provided recommendations, use tools mentioned in the Compliant Tools section whenever possible. If you are uncertain about an encryption tool, please contact security@berkeley.edu for consultation.

Additional Resources

Data Recovery Plan

If removable media is the sole copy of covered data, you should do the following to ensure covered data is securely backed-up to other devices.

Covered data is backed-up to other removable media that adhere to the requirements set forth in this document or

Password Management Tool

A password management tool is a solution that allows use of a single complex master password to protect all your other passwords and credentials in a central location. It also reduces the need for users to remember all the username and password permutations used for various application and web services.

While convenient, the breadth of access provided by a password management tool requires heightened security to protect the password management database. Here are some recommendations on how to prevent your password management database from falling into the wrong hands:

Do NOT share the password management database on websites or file sharing services

Follow good password practices when creating the master password (meet MSSND #5 requirements AND be at least 10 characters long)

Regularly backup the password management database file to prevent being locked out of all your passwords.

An example of password management tool is LastPass, which is available for free on Windows, Linux and Mac OS X operating systems.